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USER ESTABLISHES PROCESS 
WITH ENTERPRISE'S 
TRANSACTION MANAGER 



I 



USER ATTEMPTS TO EXECUTE A 
FUNCTION, WHICH MAY BE 
WITHIN A PSFS (TO FIG. 4 A) 
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TRANSACTION MANAGER REQUESTS 

ACCESS FOR USER TO SELECTED 

Pll DATA OBJECT(S) ^_ 

_ - . _ qo 
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SECURITY MANAGER IS INVOKED 
TO DETERMINE WHETHER USER IS 
ALLOWED ACCESS TO SELECTED 
Pll DATA OBJECT(S) 
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SECURITY MANAGER RENDERS DECISION 
WHETHER TO ALLOW USER ACCESS TO THE 
SELECTED Pll DATA OBJECT(S) DEPENDING 

ON WHETHER THE FUNCTION INVOLVES 
READING OR WRITING (TO FIG. 4B) 



fig. 4 
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FROM 
FIG. 4 
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USER SPECIFIES 
A PARTICULAR 
APPLICATION 
FUNCTION 




fig. 4 A 
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FROM 
FIG. 4 




fig. 4B ( *S$££ ) 
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FROM FIG. 4B 




ADD PI I OBJECT 
LABEL AS 
ADDITIONAL 
ENTRY IN CPL 
(MAY BE FIRST 
AND ONLY ENTRY) 



<--U4 

/RETURN TO FIG. 4b7\ 
( USER NOT DENIED ) 

V ACCESS TO PI I / 

V object y 

fig- 
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FROM FIG. 4C 
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HAS A 
"CPL PREVIOUSLY 
BEEN SET FOR THIS 
USER PROCESS, 
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IS 

LABEL OF 
THE PI I OBJECT EQUAL 
TO OR A PROPER SUBSET OF 
THE LABEL OF EACH OF 
THE CPL ENTRIES 



N 
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IS 

THIS PSFS 
ALLOWED TO RE-CLASSIFY 
FROM THE LABEL OR LABELS IN 
THE CPL TO THE LABEL 
IN THE PI I OBJECT 



N 
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(RETURN TO FIG. 4B: 
USER ACCESS DENIED 
BY Pll LABEL 
PROCESSING 

151 



(RETURN TO FIG. 4bT\ 
USER NOT DENIED \ 
ADDESS TO Pll J 
PROJECT ^ 



fig. 4D 



